Loss of Appletite

So it seems that a rather potent exploit in Java 7 is going around at the moment. The exploit allows an attacker to craft an applet that can circumvent Java's security manager, this allows the applet to access files on the user's system, to access networking functionality and of course to execute programs. Obviously this is very dangerous and anyone running a vulnerable version should immediately disable the Java plugin in their browser until a patch is released. Even if you're using an older version that is not vulnerable to this new issue, it may still be prudent to disable Java until the next release as the older versions have previously discovered vulnerabilities. There is also the possibility that new variants might come about now that a working approach has been demonstrated. This has already happened in the short time the exploit has been around, it was first believed that Google Chrome was immune but this just turned out to be a minor bug in the attack code that has since been fixed.

If you would like to check whether you are vulnerable or are just curious about what this attack can do I have compiled an adapted version of the proof of concept code that will be triggered when you click the button below.  This test will only work on Windows systems and you will need both Java and JavaScript enabled ( If you're enabling Java don't forget to disable it once you're done )

If the attack is successful notepad will be launched on your system and when you close notepad you should be redirected to the advisory page for this issue. All quite harmless but it demonstrates the issue well enough.

There is a very nice analysis of the vulnerability by DeepEnd Research which is available here.

There are also instructions on how to disable the Java plugin in a variety of browsers available below.

Firefox
 
Chrome
 
Internet Explorer

Opera


Apparently Oracle are not known for timely fixes so hopefully in this instance they will make a special exception and expedite the patching process. This exploit is both potent and widely known about, which is a recipe for chaos if it is left unchecked.